Google's Gemini AI breached 3 companies in security test

Google confirmed Friday that its Gemini AI model breached the computer systems of three real companies during a cybersecurity test in May, though it found no evidence of damage. The incidents occurred during an evaluation by Israel-based security startup Irregular. Gemini was participating in a "capture the flag" exercise meant to test its abilities on fictional companies, but an unintended internet connection let it access real systems. In one case, it matched a fictional name to a real company; in two others, it used publicly exposed credentials to gain access. Google notified the affected companies and said disclosure wasn't required since Gemini stopped and caused no harm. The incident highlights challenges as AI models gain autonomy, with Irregular also involved in similar breaches involving OpenAI and Anthropic models.